topic Re: timestamp for csv in Splunk Search

timestamp for csv

friskyapple — Wed, 29 Jul 2020 07:01:52 GMT

I'm just starting out with splunk and have a few CSVs that i'm trying to import. the main one contains library records from the past decade. It originally contained both in and out time, but i've broken it down to be as simple as possible to start with and given it just the initial check out time. The times are all written in the same manner. There's about 134000 entries total.

game_id,attendee_id,event_id,check_out_time 328,7199,5,2010-09-05 01:32:57 228,7241,5,2010-09-05 01:33:13 379,7327,5,2010-09-05 01:33:51 96,6729,5,2010-09-05 01:34:37

when i go to import this data , the timestamp is always wrong:

I've read through numerous forum posts on splunk and other websites and had multiple people double check the csv; I cannot identify why it struggles to pull the correct timestamp for these events.

Any help will be greatly appreciated.

Re: timestamp for csv

bowesmana — Wed, 29 Jul 2020 07:36:45 GMT

@friskyapple

You should use capital Y for 4 digit years. Your lower case y is a two digit year.

However, that timestamp is ISO8601 so I would expect it to extract it automatically

You also need to add the MAX_DAYS_AGO setting to allow it to pick up dates in 2010 as by default it will only go back 2000 days. See that setting here

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Propsconf

Re: timestamp for csv

to4kawa — Wed, 29 Jul 2020 07:30:09 GMT

2010-09-05 01:32:57

%Y-%m-%d %T

not %y

but you don't need time settings.

splunk can extract time automatically.

Re: timestamp for csv

friskyapple — Wed, 29 Jul 2020 12:43:37 GMT

holy cow it worked, thank you!! I cannot express my thanks enough.